home

00028729.exe

The executable 00028729.exe has been detected as malware by 38 anti-virus scanners. Accoriding to the detections, it is a variant of Zbot (Zeus), a trojan that attempts to steal confidential information (online credentials, and banking details) from a compromised computer and send it to online criminals via a command-and-control server.
MD5:
be971d10ef5f41ddec448c03fbd85771

SHA-1:
52463e92c6e158bcff23a33ef1c10a67a033913b

SHA-256:
ba483cbe8ebeaaea0bcb5d576a04e06d596797051ed2fe5a71642622066ee59c

Scanner detections:
38 / 68

Status:
Malware

Analysis date:
4/24/2024 3:06:32 PM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Trojan.GenericKD.1663881
895

Agnitum Outpost
Trojan.Inject
7.1.1

AhnLab V3 Security
Trojan/Win32.Fareit
2014.06.18

Avira AntiVirus
TR/Spy.ZBot.rzoqov
7.11.155.80

avast!
Win32:Injector-BRZ [Trj]
2014.9-140823

AVG
SHeur4
2015.0.3373

Baidu Antivirus
Trojan.Win32.Injector
4.0.3.14823

Bitdefender
Trojan.GenericKD.1663881
1.0.20.1175

Bkav FE
W32.GenericMswidaK.Trojan
1.3.0.4959

Comodo Security
TrojWare.Win32.Injector.OWLP
18587

Dr.Web
Trojan.PWS.Stealer.1932
9.0.1.0235

Emsisoft Anti-Malware
Trojan.GenericKD.1663881
8.14.08.23.08

ESET NOD32
Win32/Injector.BDAF (variant)
8.9961

Fortinet FortiGate
W32/Kryptik.WIF!tr
8/23/2014

F-Secure
Trojan.GenericKD.1663881
11.2014-23-08_7

G Data
Trojan.GenericKD.1663881
14.8.24

IKARUS anti.virus
Trojan-PWS.Win32.Zbot
t3scan.1.6.1.0

K7 AntiVirus
Trojan
13.1712436

Kaspersky
Trojan.Win32.Inject
14.0.0.3361

Malwarebytes
Spyware.Zbot.ED
v2014.08.23.08

McAfee
RDN/Generic.dx!dbl
5600.7029

Microsoft Security Essentials
Trojan:Win32/Chebri.B
1.10701

MicroWorld eScan
Trojan.GenericKD.1663881
15.0.0.705

NANO AntiVirus
Trojan.Win32.Zbot.cxjaze
0.28.0.60253

Norman
Agent.BCFRL
11.20140823

nProtect
Trojan.GenericKD.1663881
14.06.17.01

Panda Antivirus
Trj/Genetic.gen
14.08.23.08

Qihoo 360 Security
HEUR/Malware.QVM19.Gen
1.0.0.1015

Quick Heal
Trojan.Inject.r4
8.14.14.00

Reason Heuristics
Threat.Win.Reputation.IMP
14.9.2.17

Sophos
Troj/Agent-AGXO
4.98

SUPERAntiSpyware
Trojan.Agent/Gen-Kazy
10403

Trend Micro House Call
TROJ_SPNR.11F514
7.2.235

Trend Micro
TROJ_SPNR.11F514
10.465.23

Vba32 AntiVirus
Trojan.Inject
3.12.26.0

VIPRE Antivirus
Trojan.Win32.Generic
30404

ViRobot
Trojan.Win32.U.Downloader.483840
2011.4.7.4223

Zillya! Antivirus
Trojan.Sharik.Win32.637
2.0.0.1829

File size:
308 KB (315,392 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\appdata\roaming\00028729.exe

File PE Metadata
Compilation timestamp:
5/1/2014 10:34:28 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
3.0

CTPH (ssdeep):
6144:E9KKi7B9h5tq5/kbgz/crUMoeYghzOTCPXq7hZoFUkM8KU7KER6c5nvZ:6HM9h5A5MbgzCoeLcCC7aU1WKWb5R

Entry address:
0x3671

Entry point:
55, 8B, EC, E8, 57, DC, FF, FF, 8B, 4C, 24, 08, 8D, 86, 00, 02, 00, 00, E8, DD, FB, FF, FF, 8B, 4C, 24, 0C, 8D, 86, 00, 01, 00, 00, E8, CE, FB, FF, FF, 6A, 10, 8D, 86, 84, 01, 00, 00, 8D, 8E, 7C, 01, 00, 00, 5A, 8B, 71, FC, 89, 70, FC, 8B, 31, 89, 30, 8B, B1, FC, 00, 00, 00, 89, B0, FC, FE, FF, FF, 8B, B1, 00, 01, 00, 00, 89, B0, 00, FF, FF, FF, 8B, B1, FC, FE, FF, FF, 89, B0, FC, 00, 00, 00, 8B, B1, 00, FF, FF, FF, 89, B0, 00, 01, 00, 00, 83, C0, 08, 83, E9, 08, 4A, 75, BD, 33, C0, 5E, 6A, 0A, 58, 50, 56...
 
[+]

Entropy:
7.7972

Developed / compiled with:
Microsoft Visual C++

Code size:
12 KB (12,288 bytes)

Remove 00028729.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.